CN114584334A - Information processing apparatus and control method - Google Patents
Information processing apparatus and control method Download PDFInfo
- Publication number
- CN114584334A CN114584334A CN202111372252.3A CN202111372252A CN114584334A CN 114584334 A CN114584334 A CN 114584334A CN 202111372252 A CN202111372252 A CN 202111372252A CN 114584334 A CN114584334 A CN 114584334A
- Authority
- CN
- China
- Prior art keywords
- connection
- information
- connection request
- connection source
- list
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 230000010365 information processing Effects 0.000 title claims abstract description 14
- 238000000034 method Methods 0.000 title claims description 26
- 238000001514 detection method Methods 0.000 claims description 54
- 238000012217 deletion Methods 0.000 claims description 2
- 230000037430 deletion Effects 0.000 claims description 2
- 238000012545 processing Methods 0.000 description 76
- 238000004891 communication Methods 0.000 description 13
- 238000010586 diagram Methods 0.000 description 11
- 230000006870 function Effects 0.000 description 10
- 230000005764 inhibitory process Effects 0.000 description 9
- 230000005540 biological transmission Effects 0.000 description 6
- 230000003287 optical effect Effects 0.000 description 3
- 238000005401 electroluminescence Methods 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 238000012544 monitoring process Methods 0.000 description 2
- 230000002093 peripheral effect Effects 0.000 description 2
- 239000004065 semiconductor Substances 0.000 description 2
- 238000013459 approach Methods 0.000 description 1
- 239000011668 ascorbic acid Substances 0.000 description 1
- 239000011692 calcium ascorbate Substances 0.000 description 1
- 238000006243 chemical reaction Methods 0.000 description 1
- 239000012141 concentrate Substances 0.000 description 1
- 238000012790 confirmation Methods 0.000 description 1
- 230000005674 electromagnetic induction Effects 0.000 description 1
- 239000012634 fragment Substances 0.000 description 1
- 239000004973 liquid crystal related substance Substances 0.000 description 1
- 230000004044 response Effects 0.000 description 1
- 239000007787 solid Substances 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
- H04N1/00—Scanning, transmission or reproduction of documents or the like, e.g. facsimile transmission; Details thereof
- H04N1/44—Secrecy systems
- H04N1/4406—Restricting access, e.g. according to user identity
- H04N1/4433—Restricting access, e.g. according to user identity to an apparatus, part of an apparatus or an apparatus function
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
- H04L63/0227—Filtering policies
- H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
- H04L63/0227—Filtering policies
- H04L63/0254—Stateful filtering
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
- H04L63/108—Network architectures or network communication protocols for network security for controlling access to devices or network resources when the policy decisions are valid for a limited amount of time
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
- H04L63/1466—Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
Abstract
An information processing apparatus includes: a storage unit that stores information on a connection source in association with a time at which a rejection of a connection request from the connection source is released; and a control unit that, when receiving a connection request from the connection source, rejects the connection request based on the information stored in the storage unit. The control unit deletes, from the storage unit, information of the connection source for which the time for which the rejection of the connection request is understood has elapsed.
Description
Technical Field
The present invention relates to an information processing apparatus and the like.
Background
Conventionally, a system and an apparatus have been used which detect an unauthorized connection request transmitted from another apparatus connected to a network and prohibit access from the apparatus that transmitted the connection request.
For example, there is proposed a technique of detecting that an attack such as an Http Get Flooding attack is present in a monitoring target flow when a state (burst state) in which a packet interval of the monitoring target flow is equal to or less than a predetermined time interval continues for a time exceeding a predetermined threshold (see, for example, japanese patent application laid-open No. 2017-147558).
Disclosure of Invention
Generally, when an unauthorized connection request is detected, a process is executed for detecting an unauthorized connection request based on whether or not an IP (Internet Protocol) address of a device that has transmitted the connection request is an IP address that has been determined to be unauthorized.
Here, it is assumed that an attacker who transmits an unauthorized connection request pretends to be an IP address or controls a plurality of PCs (Personal computers), and performs an attack using a large number of IP addresses.
However, there are approximately 43 billion IP addresses in IPv 4. Here, if all IP addresses of unauthorized access targets (devices that send unauthorized connection requests) are stored as prohibited addresses, the memory of the device on the receiving side of the connection request is consumed in a large amount. In addition, a time for determining whether the IP address of the device that has transmitted the connection request is improper is required.
Therefore, it is necessary to concentrate on an object that is considered to be particularly dangerous and troublesome as an unauthorized access object, and store information on the unauthorized access object. However, in japanese patent application laid-open No. 2017-147558, such a case is not considered.
In view of the above problems, it is an object of the present disclosure to provide an information processing apparatus and the like capable of appropriately storing information of a connection source that rejects a connection request.
In order to solve the above problem, an information processing apparatus of the present disclosure includes:
a storage unit that stores information on a connection source in association with a time at which a rejection of a connection request from the connection source is released; and
a control section that rejects the connection request based on the information stored in the storage section when the connection request is received from the connection source,
the control unit deletes, from the storage unit, information of the connection source for which the time for which the rejection of the connection request is understood has elapsed.
The control method of the present disclosure includes:
a storage step of storing information on a connection source in association with a time at which rejection of a connection request from the connection source is released;
a rejecting step of rejecting the connection request based on the information stored in the storing step in a case where the connection request is received from the connection source; and
a deletion step of deleting information of the connection source that has passed the time at which the rejection of the connection request is understood.
According to the present disclosure, information of a connection source that rejects a connection request can be appropriately stored.
Drawings
Fig. 1 is an external perspective view of an image forming apparatus according to a first embodiment.
Fig. 2 is a diagram illustrating a functional configuration of the image forming apparatus according to the first embodiment.
Fig. 3 is a diagram for explaining the data structure of the inhibition list according to the first embodiment.
Fig. 4 is a diagram for explaining the flow of the connection processing in the first embodiment.
Fig. 5 is a diagram for explaining the flow of the prohibited list management process of the first embodiment.
Fig. 6 is a diagram for explaining the flow of the prohibited list management processing of the first embodiment.
Fig. 7 is a diagram for explaining a functional configuration of the image forming apparatus according to the second embodiment.
Fig. 8 is a diagram for explaining a data structure of the detection condition list according to the second embodiment.
Fig. 9 is a diagram for explaining a data structure of the forbidden list in the third embodiment.
Detailed Description
Hereinafter, an embodiment for carrying out the present invention will be described with reference to the drawings. The following embodiments are merely examples for explaining the present invention, and the technical scope of the invention described in the claims is not limited to the following description.
[1. first embodiment ]
[1.1 functional Structure ]
First, as a first embodiment, a case where the information processing apparatus of the present disclosure is configured as the image forming apparatus 10 will be described. The image forming apparatus 10 is a digital multifunction Peripheral (MFP; Multi-Function Printer/Peripheral; multifunction Printer) having a copy Function, a print Function, a scanner Function, a mail transmission Function, and the like.
The functional configuration of the image forming apparatus 10 according to the present embodiment will be described with reference to fig. 1 and 2. Fig. 1 is an external perspective view of an image forming apparatus 10, and fig. 2 is a block diagram showing a functional configuration of the image forming apparatus 10. As shown in fig. 2, the image forming apparatus 10 includes a control unit 100, an image input unit 110, an image forming unit 120, a display unit 130, an operation unit 140, a storage unit 150, and a communication unit 160.
The control unit 100 is a functional unit for controlling the image forming apparatus 10. The control Unit 100 is configured by one or more arithmetic devices (e.g., a Central Processing Unit (CPU)) that read and execute various programs stored in the storage Unit 150 to realize various functions.
The control unit 100 functions as a connection processing unit 102, a prohibition list management unit 104, and an image processing unit 106 by executing programs stored in the storage unit 150.
The connection processing unit 102 executes, via the communication unit 160, connection processing that receives a connection request from an external device and determines whether or not to permit the received connection request. The connection request received from the external device is, for example, a SYN packet (TCP-SYN packet) in TCP (transmission control protocol). The connection processing performed by the connection processing unit 102 will be described later.
The forbidden list management part 104 manages the forbidden list 152 by adding, updating, and deleting information included in the forbidden list 152 stored in the storage part 150. In the present embodiment, the prohibited list management unit 104 executes a prohibited list management process as a process of managing the prohibited list 152. The prohibition list management processing executed by the prohibition list management unit 104 will be described later.
The image processing unit 106 performs processing on various images. For example, the image processing unit 106 performs sharpening processing and gradation conversion processing on the image read by the image input unit 110.
The image input unit 110 reads a document and inputs data of the read image. For example, the Image input unit 110 is configured by a scanner Device or the like including a Device that converts optical information such as a CIS (Contact Image Sensor) or a CCD (Charge Coupled Device) into an electric signal, and reads a document placed on a platen of the Image forming apparatus 10. The image input unit 110 may be an interface (terminal) for reading image data stored in a storage medium such as a USB (Universal Serial Bus) memory or an SD card. Further, the image data may be input from another terminal device through the communication unit 160 connected to the other terminal device.
The image forming unit 120 forms (prints) an image on a recording medium such as a recording sheet. For example, the image forming section 120 is constituted by a laser printer using an electrophotographic system. The image forming unit 120 supplies recording paper from, for example, a paper feed tray 122 shown in fig. 1, forms an image on the surface of the recording paper, and discharges the recording paper from a paper discharge tray 124.
The display unit 130 displays various information. The display unit 130 is configured by a display device such as an LCD (Liquid crystal display), an organic EL (electro-luminescence) panel, or a micro LED (Light Emitting Diode).
The operation unit 140 receives an operation by a user using the image forming apparatus 10. The operation unit 140 is constituted by an input device such as a touch sensor. The method of detecting an input in the sensor may be a conventional detection method such as a resistive film method, an infrared method, an electromagnetic induction method, or a capacitive method. Further, the image forming apparatus 10 may be equipped with a touch panel formed by integrating the display unit 130 and the operation unit 140. The operation unit 140 may be configured by various operation devices such as a mouse and a keyboard, and may be configured so long as a user can input information.
The storage section 150 stores various programs and various data necessary for the operation of the image forming apparatus 10. The storage unit 150 is configured by a storage device such as an SSD (Solid State Drive) or an HDD (Hard Disk Drive) as a semiconductor memory.
The storage unit 150 stores a prohibition list 152 and notification destination information 154. The prohibited list 152 is a list storing information of connection sources for which the connection processing unit 102 has rejected a connection request. Each item stored in the prohibition list 152 includes, for example, as shown in fig. 3, information indicating a connection source, i.e., an IP (Internet Protocol) address (e.g., "192.168.100.35"), a detection time (e.g., "2019/12/1122: 08: 30"), and a prohibition release predetermined time (e.g., "2019/12/1200: 08: 30").
The detection time is a time when the connection processing unit 102 determines (detects) that the connection from the connection source is dangerous (troublesome). In the present embodiment, a condition in a case where it is determined that a connection from a connection source is dangerous is referred to as a detection condition. The detection condition is, for example, that the number of visits per predetermined time exceeds a preset set value (detection number) (for example, 50 times per 1 second). The setting value may be set in advance, or may be set by a user or a manager of image forming apparatus 10.
In the prohibition release predetermined time, a time later than the detection time (for example, 2 hours later than the detection time) is stored.
In the present embodiment, an upper limit is set on the number of connection source information that can be stored in the inhibition list 152. For example, the information of the connection source is configured to be storable in 50 in the prohibited list 152. The number of connection source information that can be stored in the prohibition list 152 may be set in advance, or may be set by a user or a manager of the image forming apparatus 10.
The notification destination information 154 is an address indicating a notification destination when the notification that the prohibition list is updated is performed. Notification destination information 154 stores information such as a mail address of a user (administrator) who manages image forming apparatus 10, an IP address of a device used, an account name of a service that realizes a chat (transmission and reception of a message) between users, and a password.
The communication unit 160 communicates with other devices via a LAN (Local Area Network) or a WAN (Wide Area Network). The communication unit 160 is configured by a communication device such as an NIC (Network Interface Card) used in a wired/wireless LAN, and a communication module.
[1.2 treatment procedure ]
[1.2.1 ligation treatment ]
The flow of connection processing executed by the connection processing unit 102 will be described with reference to fig. 4. The connection processing unit 102 waits for a connection request transmitted from an external device via the communication unit 160.
First, the connection processing unit 102 receives a connection request transmitted from an external device via the communication unit 160 (step S102).
Next, the connection processing unit 102 determines whether or not the number of connection source information stored in the prohibition list 152 reaches the upper limit (step S104). That is, the connection processing unit 102 determines whether or not the connection source information can be newly stored in the prohibition list 152.
When the number of pieces of connection source information stored in the prohibition list 152 reaches the upper limit, the connection processing unit 102 denies the connection (access) from the external device (step S104; yes → step S106).
For example, the connection processing unit 102 transmits a TCP-RST packet to a device of a connection source that transmitted the TCP-SYN packet via the communication unit 160. Thus, the image forming apparatus 10 prohibits the reception of a connection request (disconnection request) transmitted from an external apparatus.
When the number of pieces of connection source information stored in the prohibition list 152 does not reach the upper limit, the connection processing unit 102 determines whether or not the information of the device that has transmitted the connection request is present in the prohibition list 152 (step S104; no → step S108).
For example, when a TCP-SYN packet is received via the communication unit 160, the connection processing unit 102 acquires the IP address of the device that transmitted the TCP-SYN packet. When the IP address of the device that has transmitted the TCP-SYN packet is stored in any entry included in the prohibited list 152, the connection processing unit 102 determines that the information of the device that has transmitted the connection request is present in the prohibited list 152.
When the information of the device that has transmitted the connection request is present in the prohibition list 152, the connection processing unit 102 requests the prohibition list management unit 104 to extend the prohibition release predetermined time period corresponding to the device that has transmitted the connection request (step S108; yes → step S110).
For example, the connection processing unit 102 instructs the prohibition list management unit 104 to extend the prohibition release predetermined time for the device to which the connection request has been transmitted, together with the IP address of the device. The connection processing unit 102 may store information (for example, an IP address of the device that has transmitted the connection request and a flag indicating that the predetermined time for the prohibition release is to be extended) required to extend the predetermined time for the prohibition release in the storage unit 150.
Next, the connection processing section 102 denies connection (access) from the external device (step S112). The process of step S112 is the same as the process of step S106.
In step S108, when determining that the information of the device which has transmitted the connection request does not exist in the prohibition list 152, the connection processing unit 102 determines whether or not the detection condition is satisfied (step S108; no → step S114).
For example, when receiving a TCP connection request (TCP-SYN packet) 1 time, the connection processing unit 102 counts the number of accesses as 1 time. Then, the number of accesses within a prescribed time (for example, 1 second) is acquired. At this time, when the number of accesses per predetermined time is equal to or greater than a preset value, the connection processing unit 102 determines that the detection condition is satisfied.
When the detection condition is satisfied, the connection processing unit 102 requests the prohibition list management unit 104 to add information of the device that has transmitted the connection request to the prohibition list 152 (step S114; yes → step S116).
For example, the connection processing unit 102 instructs the forbidden list management unit 104 to add information of the device to the forbidden list 152 together with the IP address of the device that has transmitted the connection request. The connection processing unit 102 may store information (for example, an IP address of the device that has transmitted the connection request and a flag indicating addition to the prohibited list 152) required to add information of the device that has transmitted the connection request to the prohibited list 152 in the storage unit 150.
Next, the connection processing section 102 denies connection (access) from the external device (step S118). The process of step S118 is the same as the process of step S106.
If it is determined in step S114 that the detection condition is not satisfied, the connection processing unit 102 permits connection (access) from the external device (step S114; no → step S120).
For example, the connection processing unit 102 transmits a TCP-SYN/ACK packet to the device that has transmitted the connection request via the communication unit 160.
[1.2.2 forbidden List management processing ]
Next, the flow of the prohibition list management processing executed by the prohibition list management unit 104 will be described with reference to fig. 5 and 6. The prohibited list management unit 104 executes the prohibited list management processing at a predetermined timing (for example, every 1 second), or executes the prohibited list management processing based on the instruction of the connection processing unit 102 in step S110 and step S116 of the connection processing.
First, the processing described in fig. 5 will be explained. The prohibited list management unit 104 determines whether or not a request (update request) for updating the information stored in the prohibited list 152 is made (step S142). For example, when receiving a command for extending the prohibition release predetermined time and a command for adding information of the device that has transmitted the connection request to the prohibition list 152 from the connection processing unit 102, the prohibition list management unit 104 determines that there is an update request. When the storage unit 150 stores information indicating that the prohibition release predetermined time is extended and information for adding information of the device that has transmitted the connection request to the prohibition list 152, the prohibition list management unit 104 may determine that the update request is issued.
If there is no update request, the prohibition list management unit 104 determines whether or not the information of the connection source for releasing the connection prohibition exists in the prohibition list 152 (step S142; no → step S144).
For example, the prohibition list management unit 104 reads out an item that exceeds a time indicated by the prohibition release predetermined time, from among the items stored in the prohibition list 152. At this time, when one or more items are read, the prohibited list management unit 104 determines that the information of the connection source for releasing the connection prohibition is present in the prohibited list 152.
When the information of the connection source from which the connection is released exists in the prohibition list 152, the prohibition list management unit 104 deletes the item including the information of the connection source from which the connection is released from the prohibition list 152 (step S144; yes — step S146).
Further, the prohibited list management unit 104 notifies that there is a connection source from which the prohibition is released from the prohibited list 152 (step S148). The notification includes the IP address from which the prohibition was released, the detection time, the prohibition release time (time when step S146 was executed), and the like. The notification is performed as follows: the prohibited list management unit 104 transmits a mail or a message based on the notification destination indicated by the notification destination information 154 stored in the storage unit 150.
If it is determined in step S144 that the connection source information for releasing the connection prohibition does not exist in the prohibition list 152, the prohibition list management unit 104 ends the prohibition list management processing (step S144; no).
When it is determined in step S142 that there is an update request, the prohibited list management unit 104 determines whether or not the update request is a request for adding information of a connection source to the prohibited list 152 (step S142; yes → step S150).
If the request is not a request for adding information of a connection source, it is determined that a request for extending the prohibition release predetermined time has been issued. In this case, the prohibition list management part 104 extends the prohibition release predetermined time based on the request for extending the prohibition release predetermined time (step S150; NO → step S152).
For example, the prohibition list management unit 104 acquires the IP address stored in the storage unit 150 together with the IP address included in the command received from the connection processing unit 102 and the flag indicating that the prohibition cancellation scheduled time is extended. Next, the prohibited list management unit 104 reads out an entry including the acquired IP address from the entries stored in the prohibited list 152. Then, the prohibition list management unit 104 updates the prohibition release scheduled time stored in the read item by a predetermined time (for example, 1 minute), and stores the updated time as the prohibition release scheduled time. That is, the prohibition list management unit 104 extends the prohibition release predetermined time period corresponding to the connection source to which connection is prohibited. The extension time may be set in advance, or may be set by a user or administrator of image forming apparatus 10.
Further, the prohibition list management unit 104 notifies as follows: a notification indicating that the release predetermined time is extended is prohibited in the prohibition list 152 (step S154). The notification includes the IP address of the connection source for which the prohibition release predetermined time is extended, the detection time, the updated prohibition release predetermined time, and the like. The notification method is the same as step S148.
If it is determined in step S150 that the update request is a request indicating addition of information of a connection source to the prohibited list 152, the prohibited list management unit 104 determines whether or not there is a free area in the prohibited list 152 (step S150; yes — step S156).
For example, when the number of pieces of information on connection sources stored in the prohibited list 152 does not reach the upper limit of the number of connection sources that can be stored in the prohibited list 152, the prohibited list management unit 104 determines that there is a free area in the prohibited list 152.
If there is no free area in the prohibited list 152, some contradiction occurs in the processing executed by the control unit 100. In this case, the prohibition list management unit 104 does not update the prohibition list 152, but responds to the functional unit (for example, the control unit 100 or the connection processing unit 102) that has instructed execution of the prohibition list management processing that an error has occurred (step S156; no → step S158). The functional unit that receives the error response executes predetermined processing.
Next, referring to fig. 6, a description will be given of processing executed by the prohibition list management unit 104 when a free area exists in the prohibition list 152 in step S156. The prohibition list management part 104 adds information of the connection source to the prohibition list 152 based on the request indicating the addition of the information of the connection source to the prohibition list 152 (step S156; yes → step S172).
For example, the prohibited list management unit 104 acquires the IP address stored in the storage unit 150 together with the IP address included in the command received from the connection processing unit 102 and the flag indicating addition to the prohibited list 152. Next, the prohibition list management unit 104 adds an item including the acquired IP address, the current time as the detection time, and a time obtained by adding a predetermined time (for example, 3 hours) to the detection time as the prohibition release predetermined time to the prohibition list 152. The time added to the detection time may be set in advance, or may be set by the user or administrator of image forming apparatus 10.
In addition, the detection time plus the time can be switched according to the country and the network of the connection source. For example, the prohibited list management unit 104 may shorten the time added to the detection time when the connection source is the home country or the same segment, and may lengthen the time added to the detection time when the connection source is not the home country or a different segment. The detection time plus time may be switched according to the number of accesses. For example, the prohibition list management unit 104 may increase the time added to the detection time as the number of accesses received before the connection request is prohibited increases.
Further, the prohibition list management unit 104 notifies as follows: a notification of connection satisfying the detection condition is detected (step S174). The notification includes, for example, the detected IP address, the detection time, the prohibition release predetermined time, and the like. The notification method is the same as step S148.
Next, the prohibition list management unit 104 determines whether or not the number of connection source information stored in the prohibition list 152 reaches the upper limit (Full state) (step S176). When the upper limit is reached, the prohibited list management unit 104 notifies that the number of pieces of information indicating the connection sources stored in the prohibited list 152 has reached the upper limit (step S178). The notification method is the same as step S148.
On the other hand, when the number of pieces of connection source information stored in the inhibition list 152 does not reach the upper limit, the inhibition list management unit 104 determines whether or not the number of pieces of connection source information stored in the inhibition list 152 is close to the upper limit (the NearFull state) (step S176; no → step S180).
For example, when the number of pieces of connection source information that can be added to the prohibited list 152 is equal to or less than a preset number (reference value), the prohibited list management unit 104 determines that the number of pieces of connection source information stored in the prohibited list 152 is close to the upper limit. The reference value may be an absolute number or a number obtained from a ratio to the number of connection source information stored in the prohibition list 152. The reference value may be set in advance, or may be set by a user or administrator of image forming apparatus 10.
In this case, when the number of pieces of connection source information that can be added to the prohibition list 152 is equal to or less than the reference value, the prohibition list management unit 104 determines that the number of pieces of connection source information stored in the prohibition list 152 is close to the upper limit (step S180: yes). At this time, the prohibited list management unit 104 notifies that the number of pieces of information indicating connection sources stored in the prohibited list 152 is close to the upper limit (step S182). The notification method is the same as step S148.
On the other hand, when the prohibited list management unit 104 determines in step S180 that the number of pieces of connection source information stored in the prohibited list 152 does not approach the upper limit, the prohibited list management unit 104 ends the prohibited list management processing (step S180; no).
The notification of the availability of the prohibition list 152 may be set by a user (e.g., an administrator of the image forming apparatus 10) who receives the notification. The setting of the notification possibility may be performed for all notifications or may be performed for individual notifications. When all or a part of the notifications are rejected, the prohibition list management portion 104 skips (omits) the processes of step S148, step S154, step S174, step S178, and step S182 among the above-described processes, depending on the type of the rejected notification.
In the above description, as described in step S172, the detection time stored in the inhibition list 152 is the time when the information of the connection source is stored in the inhibition list 152, but may be the time when the detection condition is satisfied. In this case, the connection processing unit 102 is configured to prohibit the list management unit 104 from acquiring a time when the detection condition is satisfied.
According to the present embodiment, the image forming apparatus can extend the time for prohibiting access from a connection source (a connection source with a high risk and trouble) that frequently makes access (connection request). Further, it is possible to shorten the time for prohibiting access from a connection source that is accessed almost or only once (a connection source with a low risk and trouble). Thus, the time for prohibiting the connection request can be flexibly set according to the risk degree and the trouble degree.
Further, an upper limit of the number of connection source information stored in the prohibition list is set, and the connection source information stored in the prohibition list is deleted or the time stored in the prohibition list is extended by extending the prohibition release predetermined time in accordance with the transmission status of the connection request from the connection source. In this way, when the number of pieces of connection source information stored in the prohibition list is determined, the image forming apparatus can save the storage capacity of the storage device such as a memory by appropriately managing the pieces of connection source information stored in the prohibition list. Further, by deciding the upper limit of the number of connection source information stored in the inhibition list, the image forming apparatus can reduce resources (CPU load or time required for confirmation) required to confirm whether or not the connection request is permitted.
[2. second embodiment ]
Next, the second embodiment is different from the first embodiment in that the characteristics of the connection source that has transmitted the connection request are acquired, and the detection condition is switched based on the characteristics. In the present embodiment, fig. 2 of the first embodiment is replaced with fig. 7. The same functional units and processes are denoted by the same reference numerals, and description thereof is omitted.
The functional configuration of image forming apparatus 12 in the present embodiment will be described with reference to fig. 7. Image forming apparatus 12 differs from image forming apparatus 10 according to the first embodiment in that storage unit 150 further stores detection condition list 156.
The detection condition list 156 is a list in which the feature of the connection source and the detection condition corresponding to the feature are stored. Each item stored in the detection condition list 156 includes, for example, as shown in fig. 8, a connection source feature (for example, "home country") and a detection condition corresponding to the feature (for example, "1 second 70 times").
Fig. 8 is a diagram for embodying the detection condition list 156. Fig. 8(a) is an example of the detection condition list 156 in the case where the detection conditions are different depending on the country of the connection source. As shown in fig. 8(a), for example, if the connection source is the home country, the detection condition is set to 70 times in 1 second, if the connection source is determined to be a safe country, the detection condition is set to 50 times in 1 second, and if the connection source is determined to be a dangerous country, the detection condition is set to 30 times in 1 second.
In this case, the connection processing unit 102 executes the following processing in step S114 of the connection processing shown in fig. 4.
(1) Acquisition of a Source connected State
The connection processing unit 102 acquires the country to which the device that has transmitted the connection request belongs, based on the content of the connection request and the like. For example, the connection processing unit 102 acquires the IP address of the transmission source of the connection request, and acquires the country to which the IP address is assigned.
Obtaining of detection conditions
The connection processing unit 102 determines whether the acquired country belongs to any one of the home country, the safe country, and the dangerous country, and acquires the detection condition corresponding to the determination result.
The information on the countries included in the countries determined to be safe and dangerous may be stored in the storage unit 150 in advance or may be set by the user. Further, the country in which the connection request was prohibited in the past and the date and time at which the connection request was prohibited may be stored as a history in the storage unit 150, and the control unit 100 may automatically set the country determined to be safe and the country determined to be dangerous based on the history. For example, the control unit 100 determines a country in which the number of times of connection request prohibition within a predetermined period (for example, the latest one month or the like) is equal to or more than a predetermined threshold (for example, 5 times) as a dangerous country, and determines a safe country if the number is less than the predetermined threshold.
(3) Determination of whether detection conditions are satisfied
Based on the detection condition acquired in (2), the connection processing portion 102 determines whether or not the connection from the connection source is dangerous.
On the other hand, fig. 8(b) is an example of the detection condition list 156 in the case where the detection conditions are different depending on the segment of the network to which the connection source belongs. As shown in fig. 8 b, for example, the detection condition is set to 80 times for 1 second when the connection source device belongs to the same segment as the image forming apparatus 10, 60 times for 1 second when the connection source device belongs to the same site (a segment close to (a network of the same site)) as the image forming apparatus 10, and 40 times for 1 second when the connection source device belongs to a site (a network of other sites) different from the image forming apparatus 10.
In this case, the connection processing unit 102 performs (1) acquisition of a connection source fragment, (2) acquisition of a detection condition, and (3) determination as to whether or not the detection condition is satisfied in step S114 of the connection processing shown in fig. 4.
According to the present embodiment, the user can make the detection condition tight or loose according to the characteristics of the connection source, and can appropriately control access to the image forming apparatus according to the connection request.
[3 ] third embodiment ]
Next, a third embodiment will be explained. The third embodiment is different from the first embodiment in that whether or not the connection request is permitted is controlled in consideration of information other than the IP address.
Fig. 9 is a diagram showing an example of the prohibition list 152 in the present embodiment. The prohibited list 152 in the present embodiment is different from the prohibited list 152 shown in fig. 3 of the first embodiment in that a port number is also stored.
For example, the entry shown in E300 of fig. 9 indicates that the connection request is prohibited when the IP address is "192.168.113.207" and the port numbers are "20, 21". As shown in E302 of fig. 9, the following items may be stored: if the IP address is "192.168.58.136", the connection request is prohibited regardless of the port number.
As described above, in the present embodiment, the IP address and the port number are stored in the prohibited list 152, and the connection processing unit 102 determines whether or not the connection request is permitted based on the combination of the IP address and the port number.
As shown in fig. 9, the forbidden list 152 in this embodiment may not be a format for storing IP addresses and port numbers. That is, the information for determining whether the connection request is permitted may not be a combination of the IP address and the port number.
For example, when the image forming apparatus 10 is directly connected to another apparatus, a Media Access Control (MAC) address may be used as information for determining whether or not the connection request is permitted.
In the present embodiment, in step S116 of the connection processing shown in fig. 4, the connection processing unit 102 includes information such as the IP address and the used port number of the connection source device in the addition request to the prohibition list 152. At this time, what information is included in the addition request to the prohibition list 152 may be determined in advance, or may be determined based on the connection request when the detection condition is satisfied.
As an example of the operation of the present embodiment, for example, in a case where the image forming apparatus 10 is set via a page provided by a Web server in the image forming apparatus 10 equipped with the Web server, an operation of switching whether or not the connection request is permitted can be performed. For example, when a connection request for acquiring a page is frequently made from a certain apparatus to the image forming apparatus 10, the connection processing unit 102 prohibits a connection request from an IP address and a port number included in the connection request. In this case, if the port number included in the connection request for acquiring the page and the port number included in the connection request for transmitting the print data are different, the image forming apparatus 10 does not reject the connection request for transmitting the print data. Therefore, even if the image forming apparatus 10 prohibits the acquisition of pages, it is possible to transmit print data (for example, communication via a printer driver) to the image forming apparatus 10.
As described above, according to the present embodiment, the image forming apparatus can flexibly control whether or not to accept a connection request from another apparatus.
[4 ] fourth embodiment ]
The fourth embodiment is an embodiment in which the information processing apparatus of the present disclosure is configured by an apparatus other than the image forming apparatus. The device that executes control of whether or not the connection request is permitted may be an information processing device such as a pc (personal computer), a server device, a smartphone, a tablet, or a so-called iot (internet of things) device.
In any device, the control unit for controlling the device may execute the processing executed by the connection processing unit 102 and the processing executed by the inhibition list management unit 104 from the first to third embodiments. Thus, each device can reject a connection request from another device by dividing a predetermined time, or automatically reject a connection request according to the number of accesses.
[5. modification ]
The present invention is not limited to the above embodiments, and various modifications can be made. That is, embodiments obtained by combining appropriately modified technical means within a range not departing from the gist of the present invention are also included in the technical scope of the present invention.
For convenience of explanation, the above embodiments have been described separately, but it is needless to say that they may be combined and executed within a technically possible range. For example, by combining the second embodiment and the third embodiment, the image forming apparatus can switch the detection condition corresponding to the information of the transmission source of the connection request and control whether or not the connection request corresponding to the connection request is permitted.
The program to be run in each device of the present embodiment is a program (a program for causing a computer to function) for controlling a CPU or the like so as to realize the functions of the above embodiments. The information processed by these devices is temporarily stored in a temporary storage device (e.g., RAM) when it is processed, and then stored in various storage devices such as rom (read Only memory) and HDD, and read, modified, and written by the CPU as necessary.
Here, the storage medium storing the program may be any of a semiconductor medium (e.g., a ROM, a nonvolatile memory card, etc.), an Optical recording medium, a Magneto-Optical recording medium (e.g., a DVD (Digital Versatile Disc), an MO (magnetic Optical Disc), an MD (Mini Disc), a CD (Compact Disc), a BD (Blu-ray Disc, etc.), a magnetic recording medium (e.g., a magnetic tape, a flexible disk, etc.), and the like. Further, by executing the downloaded program, not only the functions of the above-described embodiments can be realized, but also the functions of one aspect of the present invention can be realized by performing common processing by an operating system, another application program, or the like based on instructions of the program.
In the case of distribution to the market, the program may be stored in a portable storage medium and distributed, or may be transferred to a service computer connected via a network such as the internet. In this case, the storage device of the service computer is also included in the present invention.
Claims (6)
1. An information processing apparatus, comprising:
a storage unit that stores information on a connection source in association with a time at which a rejection of a connection request from the connection source is released; and
a control section that rejects the connection request based on the information stored in the storage section when the connection request is received from the connection source,
the control unit deletes, from the storage unit, information of the connection source for which the time for which the rejection of the connection request is understood has elapsed.
2. The information processing apparatus according to claim 1,
the control unit extends a time for canceling the rejection of the connection request from the connection source when the connection request is received from the connection source to which the connection request is rejected.
3. The information processing apparatus according to claim 1 or 2,
the control unit stores, in the storage unit, a connection source in association with a time at which rejection of a connection request from the connection source is released, when a reception frequency of the connection request transmitted from the connection source satisfies a detection condition.
4. The information processing apparatus according to claim 3,
the control unit switches the detection condition according to a connection source.
5. The information processing apparatus according to any one of claims 1 to 4,
the information of the connection source is any one of an IP address, a MAC address, a port number, or a combination thereof.
6. A control method, characterized in that
A storage step of storing information on a connection source in association with a time at which rejection of a connection request from the connection source is released;
a rejection step of rejecting the connection request based on the information stored in the storage step in a case where the connection request is received from the connection source; and
a deletion step of deleting information of the connection source that has passed the time at which the rejection of the connection request is understood.
Applications Claiming Priority (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| JP2020-198698 | 2020-11-30 | ||
| JP2020198698A JP2022086597A (en) | 2020-11-30 | 2020-11-30 | Information processing device, control method, and program |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN114584334A true CN114584334A (en) | 2022-06-03 |
Family
ID=81751960
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202111372252.3A Pending CN114584334A (en) | 2020-11-30 | 2021-11-18 | Information processing apparatus and control method |
Country Status (3)
| Country | Link |
|---|---|
| US (1) | US20220174071A1 (en) |
| JP (1) | JP2022086597A (en) |
| CN (1) | CN114584334A (en) |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20100242096A1 (en) * | 2009-03-20 | 2010-09-23 | Prakash Varadharajan | Managing connections in a data storage system |
| CN102300023A (en) * | 2010-06-22 | 2011-12-28 | 佳能株式会社 | Information processing apparatus and controlling method thereof |
| CN103384250A (en) * | 2006-08-03 | 2013-11-06 | 思杰系统有限公司 | Systems and methods for application-based interception and authorization of ssl/vpn traffic |
| CN106789858A (en) * | 2015-11-25 | 2017-05-31 | 广州市动景计算机科技有限公司 | A kind of access control method and device and server |
| US10382461B1 (en) * | 2016-05-26 | 2019-08-13 | Amazon Technologies, Inc. | System for determining anomalies associated with a request |
| US20200274874A1 (en) * | 2019-02-25 | 2020-08-27 | Fuji Xerox Co., Ltd. | Communication control apparatus, communication system, and non-transitory computer readable medium |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108400963A (en) * | 2017-10-23 | 2018-08-14 | 平安科技（深圳）有限公司 | Electronic device, access request control method and computer readable storage medium |
-
2020
- 2020-11-30 JP JP2020198698A patent/JP2022086597A/en active Pending
-
2021
- 2021-11-18 CN CN202111372252.3A patent/CN114584334A/en active Pending
- 2021-11-18 US US17/529,877 patent/US20220174071A1/en active Pending
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103384250A (en) * | 2006-08-03 | 2013-11-06 | 思杰系统有限公司 | Systems and methods for application-based interception and authorization of ssl/vpn traffic |
| US20100242096A1 (en) * | 2009-03-20 | 2010-09-23 | Prakash Varadharajan | Managing connections in a data storage system |
| CN102300023A (en) * | 2010-06-22 | 2011-12-28 | 佳能株式会社 | Information processing apparatus and controlling method thereof |
| CN106789858A (en) * | 2015-11-25 | 2017-05-31 | 广州市动景计算机科技有限公司 | A kind of access control method and device and server |
| US10382461B1 (en) * | 2016-05-26 | 2019-08-13 | Amazon Technologies, Inc. | System for determining anomalies associated with a request |
| US20200274874A1 (en) * | 2019-02-25 | 2020-08-27 | Fuji Xerox Co., Ltd. | Communication control apparatus, communication system, and non-transitory computer readable medium |
Also Published As
| Publication number | Publication date |
|---|---|
| US20220174071A1 (en) | 2022-06-02 |
| JP2022086597A (en) | 2022-06-09 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| JP4788808B2 (en) | Job processing system, image processing apparatus, virus detection method, and virus detection program | |
| US8593663B2 (en) | Image forming apparatus for storing and processing electronic documents and image data, data processing method, and storage medium thereof | |
| US8582137B2 (en) | Method and system for managing security of a remote device using a multifunction peripheral | |
| US8135931B2 (en) | Information equipment, method for supporting operation thereof, and computer-readable storage medium for computer program | |
| US20180007234A1 (en) | Image processing system and image processing apparatus for sending image data | |
| US8248633B2 (en) | Image forming apparatus and method for switching between security modes | |
| JP4330545B2 (en) | Data processing apparatus, erroneous operation notification method, program, and recording medium | |
| US20070044154A1 (en) | Mail reception system | |
| JP2012185804A (en) | Information processor, information processing system, information processing method, and program | |
| US11144261B2 (en) | Information processing apparatus with transfer-prohibition control for saved data and non-transitory computer readable medium | |
| US8296830B2 (en) | Management apparatus and control method of management apparatus | |
| JP5773938B2 (en) | Image forming system and management server program | |
| JP2009252125A (en) | Image forming system and image forming apparatus | |
| JP2019022171A (en) | Communication control device and communication line system | |
| US20230179636A1 (en) | Information processing apparatus, method for controlling the same, and storage medium | |
| CN114584334A (en) | Information processing apparatus and control method | |
| US9509879B2 (en) | Image processing apparatus, method for controlling image processing apparatus, and storage medium | |
| JP2011205461A (en) | Processing device and control program | |
| JP5124241B2 (en) | Information processing apparatus, information processing method, information processing program, and recording medium | |
| US20230315873A1 (en) | Information processing apparatus and control method | |
| US20230057839A1 (en) | Image forming apparatus | |
| US20240020069A1 (en) | Information processing system, information processing apparatus, and control method for information processing system | |
| US11182116B2 (en) | Information processing apparatus and non-transitory computer readable medium | |
| JP2016135603A (en) | Information processing apparatus, information processing method, program, and recording medium | |
| JP2023176413A (en) | Image forming device and determination method in processing device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |